google / google/security-research

Kernel Dashboard is missing edges without a path to a syscall

Open
#175 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
4.6k
Forks
582
Avg merge
1d 5h
Merged PRs (30d)
3

Description

The way the dashboard is generated is that we only show it in the list if there is a known path to a syscall (because we do an [inner join](https://github.com/google/security-research/blob/bf0d68f3ce617bdfe6b01ce4c205b56116884b29/analysis/kernel/dashboard/frontend/db/sql/codeql_data-6.1.db/prolog.sql#L91))

However, there are interesting paths from what originally are things like function pointers, which would be good to show too.

We can do this by doing a UNION SELECT with edges_with_functions rather than just one with edges_with_functions_per_syscall here: https://github.com/google/security-research/blob/master/analysis/kernel/dashboard/frontend/db/sql/codeql_data-6.1.db/query-Paths_getParentEdgesByFileLine.sql

An example of a function with "parents" that don't come from direct callgraph from a syscall is [blkcg_unpin_online](https://storage.googleapis.com/kernelctf-dash/processed/v6.1.111/index.html#block/blk-cgroup.c:1108:1118
) so it shows up as an empty parent

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.